Security Misconfiguration
Security misconfiguration is default configs, redundant features, or incorrect header settings weakening security; an OWASP Top 10 vulnerability.
Purpose
To understand configuration security baselines and defenses; the core of deployment security.
Mechanism
Flaws include default credentials, debug mode on, directory listing, unnecessary features/ports, missing security headers, and error messages leaking versions. Defenses: hardened baseline configs, automated scanning, minimization, periodic audits.
Use cases
- Configuration security audit
- Baseline hardening
- Deployment security